Efficient multiparty quantum secret sharing of secure direct communication 



in 
o 
o 

(N 
O 

Q 



> 

(N 

(N 
O 

in 
o 

Oh: 

-I— > ' 
cd 



Jian Wang0 Quan Zhang, and Chao-jing Tang 
School of Electronic Science and Engineering, 
National University of Defense Technology, 
Changsha, 410073, China 

In this paper, we present an (n, n) threshold quantum secret sharing scheme of secure direct 
communication using Greenberger-Horne-Zeilinger state. The present scheme is efficient in that 
all the Greenberger-Horne-Zeilinger states used in the quantum secret sharing scheme are used to 
generate shared secret messages except those chosen for checking eavesdropper. In our scheme, the 
measuring basis of communication parties is invariable and the classical information used to check 
eavesdropping needs only the results of measurements of the communication parties. Another nice 
feature of our scheme is that the sender transmit her secret messages to the receivers directly and 
the receivers recover the sender's secret by combining their results, different from the QSS scheme 
whose object is essentially to allow a sender to establish a shared key with the receivers. This feature 
of our scheme is similar to that of quantum secret direct communication. 

PACS numbers: 03.67.Dd, 03.65.Ud 



I. INTRODUCTION 

Quantum key distribution (QKD) is one of the most 
promising applications of quantum information science. 
The goal of QKD is to allow two legitimate parties, Alice 
and Bob, to generate a secret key over a long distance, in 
the presence of an eavesdropper, Eve, who interferes with 
the signals. QKD has progressed quickly since Benneett 
and Brassard designed the original QKD protocol 0. Re- 
cently, a novel concept, quantum secure direct communi- 
cation (QSDC) has been proposed and pursued 0, 0, 0- 
Different from QKD, QSDC's object is to transmit the 
secret messages directly without first establishing a key 
to encrypt them. QSDC can be used in some special en- 
vironments which has been shown by Bostroem and Deng 
etal-HQ. 

Quantum secret sharing (QSS)0,@ is another impor- 
tant application of quantum mechanics. The basic idea 
of secret sharing in the simplest case is that the sender 
Alice splits the secret message into two shares and dis- 
tributes them to two receivers Bob and Charlie sepa- 
rately, such that only the two receivers collaborate can 
they reconstruct the secret message. In a more general 
setting, a (to, n) threshold scheme, the secret message 
is split into n shares, such that any to of those shares 
can be used to reconstruct it. QSS is the generalization 
of classical secret sharing and can share both classical 
and quantum messages. QSS is likely to play a key role 
in protecting secret quantum information, e.g., in secure 
operations of distributed quantum computation, sharing 
difficult-to-construct ancillary states and joint sharing of 
quantum money, etc. Many researches have been carried 
out in both theoretical and experimental aspects after 
the pioneering QSS scheme proposed by Hillcry, Buzck 
and Berthiaume in 1999 (hereafter called HBB99)[1]. 



'Electronic address: jwang@nudt.edu.cn 



The HBB99 scheme is based on a three-particle entan- 
gled Greenberger-Horne-Zeilinger (GHZ) state. Karls- 
son, Koashi and ImotoQ proposed a QSS scheme us- 
ing two-particle Bell states. Guo-Ping Guo and Guang- 
Can GuoQ presented a QSS scheme where only prod- 
uct states are employed. Zhan-jun Zhang, Yong Li and 
Zhong-xiao Man 8] proposed a QSS scheme using single 
photons. 

The efficiency is one of the important parameters of 
quantum protocol. In the HBB99 scheme, only half of the 
GHZ states can be used to generate shared secret mes- 
sages, because the communication parties, Alice, Bob, 
and Charlie need to choose randomly one measuring ba- 
sis from either the X-basis or the Y-basis, respectively. 
Recently, Li Xiao, Gui Lu Long, Fu Guo Deng, and 
Jian Wei Pan@ generalized the HBB99 scheme into ar- 
bitrary multiparties and improved the efficiency of the 
QSS scheme by two techniques from quantum key dis- 
tribution (hereafter called XLDP04). One of the two 
techniques is that all the participants choose their mea- 
suring basis asymmetrically ^3 1 another one is that all 
the participants choose their measuring basis according 
to a control key|ll|. However, the flaws of the above two 
techniques are obvious. The scheme using the first tech- 
nique needs a refined data analysis and the scheme using 
the other one requires the communication parties share 
a common key. 

In this paper, we present an efficient multiparty QSS 
scheme using GHZ state and its transformation. It has 
the high intrinsic efficiency as all the states are used 
for secret sharing except that chosen for eavesdropping 
check. It is not necessarily for the communication par- 
ties to chose measuring basis for the measuring basis is 
invariable in our scheme. In the eavesdropping check of 
the scheme, the communication parties need only to an- 
nounce their results of measurements. Our scheme pro- 
vides higher efficiency than that of the XLDP04 scheme, 
for the intrinsic shortage of their scheme. Moreover, the 
sender, Alice can transmit her secret messages directly to 
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the receivers, which is similar to QSDC. The receivers can 
only recover the secure direct transmitted messages by 
combining their results, after Alice announces her results. 
Therefore the present scheme may also be called multi- 
party quantum secure direct communication scheme. 

This paper is organized as follows. In Sec|H] we de- 
scribe the three-party QSS scheme. In Sec lIIII we dis- 
cuss the security of the present scheme. In Sec lIVI we 
generalize the three-party QSS scheme to (n, n) thresh- 
old scheme. Finally, we give a summary in SecfVl 



II. THREE-PARTY QSS SCHEME 

In the three-party QSS scheme, we suppose the sender 
Alice wants to send a secret message to two receivers, 
say Bob and charlie, so that none of the receivers can 
recover the messages on his own. The basic idea of the 
scheme originates from quantum teleportation[T^| . Al- 
ice entangles his encoded secret message state with a 
prepared three-particle entangled state. She then per- 
forms controlled-NOT (CNOT) operation and Hadamard 
transformation, which is similar to the method used in 
quantum teleportation. Different from quantum telepor- 
tation, the receivers measure their particles in a fixed 
measuring basis instead of performing unitary operation 
to recover the sending qubit with Alice's classical mes- 
sage. The three-party QSS scheme is as follows: 

(1) Alice prepares an ordered N three-particle states. 
Each of three-particle states is randomly in the state 



|^) = i(|000) + |lll)) Ai3C , 



|^) = _(|0 + 0) + |1-1))abc, 



|^ 3 ) = _(|00+) + |ll-)) AB c, 



|^) = _(|0 + +> + |l--)i 



ABC, 



(1) 



(2) 



(3) 



(4) 



where |+) = ^(|0) + |1», [-) = ^(|0) 
|1)). We denotes the ordered N three-particle qubits 
with {[P 1 (A),P 1 (B),P 1 (C)}, [P 2 (A),P 2 (B),P 2 (C)}, 
[Pn(A),Pn(B),Pn(C)]}, where the subscript indicates 
the order of each three-particle in the sequence, and A, 
B, C represents the three particles of each state, respec- 
tively. Alice takes one particle from each state to form 
an ordered partner particle sequence [Pi (A), P 2 {A),- ■ ■ , 
Pat (A)], called A sequence. The remaining partner parti- 
cles compose B sequence, \P\{B), P 2 (B),- • • , Pn{B)} and 
C sequence, [Pi(C), P 2 (C),- • • , P N {C)]. Alice sends B 
sequence and C sequence to each Bob and Charlie. Bob 
and Charlie then inform Alice that they have received N 
particles, respectively. 



(2) After hearing from Bob and Charlie, Alice an- 
nounces publicly each of three-particle states she pre- 
pared. If the state of [Pi^P^-B^P^C)] is \ip 2 ) (|^3>), 
Bob (Charlie) performs Hadamard transformation 



(5) 



on Pi(B). If the state of [Pi(A),Pi(B),Pi(C)} is |^ 4 ), 
Bob and Charlie perform Hadamard transformation on 
Pi(B), Pj(C), respectively. The Hadamard transforma- 
tion is crucial for the security of the scheme as we will 
see in the sequel. After Bob and Charlie have done 
Hadamard transformation, they inform Alice. Alice then 
selects randomly a sufficiently large subset of particles 
from A sequence, which we call D sequence. Alice gener- 
ates a random bit string and encodes it on D sequence. If 
Alice's random bit is "0"("1"), she prepares a particle a 
in the state |+) = ^(|0) + |1» (|-) = ^(|0> - |1))) for 
each particle of D sequence. D sequence is used to check 
eavesdropping, which we call checking sequence. The re- 
maining particles of A sequence forms E sequence. E 
sequence is used to encode Alice's secret message, which 
we call message encoding sequence. Alice then encodes 
her secret message on E sequence. Similarly, if Alice's se- 
cret message is "0" ("1"), she prepares a particle a in the 
state |+) (|— )) for each particle of E sequence. Thus Al- 
ice prepares N particles for each particle of A sequence, 
which we call a sequence [Pi (a), P 2 {a),- • • , Pjv(a)]. 

(3) If the state of the particle P l {a) (i = 1, 2, • • • , N) 
is |+), then the state of the particle Pi (a), Pi(A), P,(B), 
and Pi(C) is 



l*o) 



1 



aABC 



V2 



(|0> 



1 



|1))„® -/|(|000) + W(6) 



where the subscript a denotes the particle Pi (a). If the 
state of the particle Pi (a) is |— ), then the state of the 
particle Pi (a), P»(A), Pj(B), and P 4 (C) is 



aABC 



|1))««-^(|000) + 1111)Ubc.(7) 



(4) Alice sends the particle Pi (a), Pi (A) through a 
CNOT gate (Pi (a) is the controller, Pi (A) is the target). 
Then \&o) a ABC becomes 



\K)aABC = 2 (|0000> + |1100) + |01U) + l 1011 > Wc, 



(8) 



and l&^aAsc 1S changed to 

Wi)aABC = ^(10000) - |1100) + |0111> - |1011)Wbc 



(9) 



(5) Alice performs Hadamard transformation on the 
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particle P^(a) and obtains 

\n) aA Bc = 5[|00U®^(|0Q) + |11))bc 
+|10) Oj4 ®i=(|00)-|ll)) B c 
+|01) Oj4 ®i=(|00) + |ll)) B c 



111' 



aA 



-L(|ii)_|oo)) BO ]. (io) 



or 



WDaABC 





.-L(|00) 


-|11»BC 




^(100)- 


h\n)) BC 


+|01) oA 6 


>71 (|11) - 


- |oo)) BC 




>>»>. 


MH))bc]. (11 



Noting that 

-±=(|oo) + |ii)) BC = _L (| + +) + |- -)) BC , (12) 



-L(|00) - |11» BC = _L (| + -) + |- +)) BC , (13) 



we can also write 

WolaABC = \m)aA' 



71 (l 
71 (l 
71 (l 



- -))bc 
-+))bc 
~-))bc 
-+))bc], 



At this step, although Bob and Charlie obtain their re- 
sults of measurements, they cannot recover Alice's secret 
message even if they collaborate, because they have no 
information of Alice's result. We can draw the above 
conclusion according to the eciuationll4land H5l 

(7) Alice tells Bob and Charlie the order of D sequence 
(checking sequence) . She randomly selects half of parti- 
cles of D sequence. She lets Bob announce his results 
of measurements of the corresponding particles of B se- 
quence firstly and then lets Charlie announce his results 
of measurements of the corresponding particles of C se- 
quence. For the other half of particles of D sequence she 
lets Charlie firstly announce his results of measurements 
and then does Bob. Alice judges whether her random 
bits can be reconstructed correctly by combining Bob's 
and Charlie's results. If the error rate is small, Alice can 
conclude that there is no eavesdroppers in the line. Al- 
ice, Bob and Charlie continue to perform the next step, 
otherwise they abort the communication. 

(8) If Alice is certain that there is no eavesdropping, 
she announces the results of measurements of E sequence 
(message encoding sequence). Thus Bob and Charlie can 
collaborate to recover Alice's secret message, according 
to Alice's results, as illustrated in Table 1. 



TABLE I: The recovery of Alice's secret message 



Alice's result 


Bob's result 


Charlie's result 


secret message 





1+) 


1+) 








1+) 




1 







1+) 


1 












1 


1+) 


1+) 


1 


1 


1+) 







1 




1+) 





1 






1 



(14) 



Suppose the results of Bob and Charlie are both |+). 
If Alice's result of measurement of particle a is "0" ("1"), 
they then conclude that the Alice's secret message is "0" 
("1"). 



Wi)a 



ABC 



+I11L, c 



1 

71 
1 

71 
i 

71 



-)) 



(l + +) + l + +» 



BC 



BC 



(! + +> + ! 



-))bc 
-))bc] 



(15) 



(6) Alice then measures the particle Pi (a), ^i(A) in the 
Z-basis, {|0),|1)}. Bob and Charlie measure the parti- 
cle Pi(-B), P-i(C) in the AT-basis, {|+), |— )}, respectively. 



III. SECURITY OF THE THREE-PARTY QSS 
SCHEME 



So far we have proposed the three-party QSS scheme. 
We now discuss the security of the present scheme. The 
crucial point is that the randomly prepared four states 
l^i)) 1^2)) 1^3) an d IV^) do not allow an eavesdropper 
to have a successful attack and the eavesdropper's attack 
will be detected during the eavesdropping check. 

We first consider the intercept-resend attack strategy. 
Suppose that Bob is dishonest and he has managed to 
get a hold of Charlie's particle as well as his own. We 
call the dishonest Bob, Bob*. Bob* can only intercept 
C sequence at the step 1 of the scheme and he cannot 
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make certain to which state does each of the intercepted 
particles belong. ^2), 1^3) and ^4) can also be 

expressed as 



1 



l^i) = 2[I+>a(|00> 



|H»BC 

-), l (|(io>-|ii)) B c], 



(16) 



life) 



2V2 



{[|+) a [(|00)-|11)) + (|01) + |10))]bc 



+|-) a [(|00) + |11)) + (|10)-|01))]bc}, (17) 



IV*> = ^={[|+>a[(|00>-|H)) + (|01) + |10))]bc 

+ |-) A [(|00) + |11)) + (|01)-|10))] BC }, (18) 



1^4) 



[|+) a (|00) + |11))bc 
1-^(101) + |10)) BC ]. 



(19) 



Bob* measures Pi(B), Pi(C) in the Bell basis and 
then resends Pi(C) to Charlie. Suppose Bob* obtains 
-i=(|00) + |11)) after his Bell basis measurement. If 

the original state of p»(A), P t {B), P t (C)} is \ip 2 ), then 
the state collapses to |— )^(|00) + |11)). According to 
the scheme, the state of pi (a), Pi(A), P t {B), Pj(C)] is 
changed to |l-) aA (| + 0) + | - l)) BC or |0-) aA (| + 0) + 
I — 1))bc at the step 6 of the scheme. Without Alice's 
result, Bob* cannot have any information about Alice's 
secret message. Moreover, Bob*'s eavesdropping will be 
detected during the eavesdropping check. Because Char- 
lie measures his particle in the X basis, Alice will find 
half of her secret messages reconstructed by the results 
of Bob* and Charlie are inconsistent with those of her. 
The error rate introduced by Bob* will achieve 50%. 
If the original state of [Pi (A), Pi(B), P l {C)} is |V> 3 ), 
Bob*'s eavesdropping will also introduce the error rate 
of 50%. Similarly, suppose Bob* obtains ^(|00) - |11)) 
after his Bell basis measurement. If the original state 
of p» (A), Pi(-B), P»(C)] is |t/> 2 ), then the state collapses 
to |+) j4 (|00) — 1 11)). According to the scheme, the state 
of pi(a), Pi(A), Pi{B), Pi(C)] becomes |0+> oA (| + 0) - 
I - 1))bc or jl+) aA (| +0) + | - l))sc at the step 6 of the 
scheme. During the eavesdropping check, Bob*'s eaves- 
dropping will be detected with probability 50%. If the 
original state of pj(A), Pi(-B), P»(C)] is |V> 3 ), we can 
draw the same conclusion. Similarly, if Bob* obtains 
^(|01) + |10» or ^(|01) - 1 10>), his eavesdropping will 
also be detected during the eavesdropping check. 

We then consider the collective attack strategy. If 
Bob* intercepts Charlie's particle C and uses it and his 
own ancillary particle B' in the state |0) to do a CNOT 
operation (the particle C is the controller, Bob*'s ancil- 
lary particle, B' is the target). After that, Bob* resends 
the particle C to Charlie. Bob* cannot make certain to 



which state does the intercepted particle belong since Al- 
ice prepared the three-particle states in \tpi), \ip2)> \ip3} 
or ^4) randomly. Bob* can performs CNOT operation 
or Hadamard plus CNOT operation in this attack strat- 
egy. Suppose the original state of pi (A), Pi(B), Pi(C)] 
is \ipi) or \1jj2) and Bob* performs CNOT operation on 
the intercepted particle and his ancillary particle. At the 
step 5 of the scheme, the state of pi (a), Pi(A), Pi(B), 
Pi(B'), Pi(C)] will be 

^[|00} aA ®^(|000> + |lll>)BB<C 

+|10U®^(|000)-|111))bb'C 

+ \01) aA ®^=(\000) + \lll)) B B'C 



or 



+ |H)aA®^(|lll)-|000)) B B'c] 



^[|00) aA ®^=(|000)-|lll))BB'C 

+ \10) aA ®-j=(\000) + \lll)) B B'C 
+ \01) aA ®-j=(\lll)-\000))BB'C 

+|H>aA®^(|000) + |lll)) BB ,cr], 



(20) 



(21) 



where the subscripts B and B' represent Bob*'s particle 
sent by Alice and his ancillary particle, respectively. Note 
that 

-±=(|000) + |111»bb'C = |[(|00) + |11» BB , ® \+) c 



+(|00>-|11» 



BB' 



He 



(22) 



and 



^=(|000) - |111) Wc = |[(|00> - |11))bb' 



l+>c 



+(|00) + |11))bb'®|-) c ]. 



(23) 

Bob* measures the particle B,B' , but he can only obtain 
(| 00) + 1 1 1) ) bb' or ( 1 00) - 1 1 1) ) bb' , each with proba- 
bility 1/2. Without Charlie's result, Bob* cannot obtain 
any information about Alice's secret message. During 
the eavesdropping check, Bob*'s eavesdropping will be 
detected since Alice randomly let Bob or Charlie firstly 
announce their results of measurements. Suppose the 
original state of [Pi(A), P t {B), P»(C)] is |^ 3 ) or and 
Bob* performs Hadamard plus CNOT operation on the 
intercepted particle and his ancillary particle. Similarly, 
at the step 5 of the scheme, the state of [Pi (a), Pi(A), 



Pi(-B), Pi(B'), Pj(C)] can also be expressed as the equa- 
tionl2Ulorl21l Thus Bob* cannot also obtain any informa- 
tion about Alice's secret message without Charlie's result 
and his eavesdropping will be detected by Alice easily. 



IV. MULTIPARTY QSS SCHEME 

We can easily generalize the three-party QSS scheme 
to a n-party(n > 3) QSS one. Suppose that Alice want 
to send her secret message to n — 1 users. Alice prepare 
an ordered N n-particle states. Each of n-particle states 
is randomly in the state 



1 n n 

i*i>=- f (ni°) a ,+ni i )a, 

v 2=1 2=1 



(24) 



1 n n 

i* 2 > = ^= (io+> Qia2 n io) 0i + ii-> 010a n (25) 



i=3 



i=3 



-. n — 1 7t— 1 

l*«)=7f(ni°)aJ+)a„ + ni 1 ) Q J-)aJ I ( 26 ) 



1 n n 

* n+1 ) = -=(io) Qi n i+) 0i + ii>oi n i-u> ( 2? ) 

V 1 i=2 



i=2 



where ai denotes the sender, Alice's particle and aj de- 
notes the i-th user's particle (i = 1, 2, • • • , n). The fol- 
lowing steps of the multiparty scheme is similar to those 
of the three-party scheme. After transmitting the par- 
ticles to n — 1 users, Alice announces publicly each of 
n-particle states she prepared. The user, performs 
Hadamard transformation on his corresponding particle 
according to Alice's information. Alice selects randomly 
a sufficiently large subset of particles from her particle 
sequence, which is formed checking sequence. Alice gen- 
erates a random bit string and encodes it on the check- 
ing sequence. The remaining particles of Alice particle 
sequence forms message encoding sequence, on which Al- 
ice encodes her secret message. Alice's random bit string 
and secret message forms a AT-bit string. Alice prepares a 
particle, a in the state |+) or |— ) according to the value 
of each bit of the AT- bit string. She then performs a 
CNOT operation on her own particles a and a±, where a 
is the controller, a\ is the target. The state of the system 
becomes 

n n 

^(ioo> aai ® n i°> Ql + i n u ® n i°>a. 

VZ i=2 t=2 

n n 

+ioi> aai ^ni i >a ! +i io u®ni i u (28) 

2=2 2=2 



1 n n 

^(loou^n^Hnu^ni ^ 



i=2 



i=2 



-ioiu®nii) ai -iio) aai ®nii) 0i ). (29) 



i=2 



i=2 



Alice performs Hadamard transformation on the particle 
a, obtaining 

1 n n 

^[lo+u^^dii^+ni 1 )^) 

1 n n 

+ii-}aa 1 ^(ni°> Ql -ni i u ( 3 °) 

^ 1 z=2 i=2 



or 



1 n n 



z=2 2=2 



1 n n 

+i i +>aa 1 ®^(ni°) Ql +ni i ) Ql ) (31) 

VZ i=2 i=2 

Noting that 

n n 

\n ) = ( nio) a! +nii> Ql ) 

V 1 i=2 i=2 

1 71 — 1 n — 1 

= 2[(ni°)a I +ni i ) a ,)®i+) Q „ 

2=2 2=2 
71 — 1 71 — 1 

+ (11 l )a» - II \ l )a % )®\-)a n (32) 
i=2 i=2 

and 

1 n n 
l"l> = -S(II|0>«H-Il|l>a 4 ) 

V 1 2=2 2=2 

1 n— 1 n—1 

= 5[dii°)-«-ll i 1 )-.) ®i+>-» 



2 = 2 2=2 

n—1 n—1 

-flli^ + IH 1 )*) 



(33) 



i=2 



i=2 



we can rewritten |Oo), |fii) in the A-basis by iterating 
the equation 03 ESI We then obtain 



i=2 



(34) 



The right of the equation 1341 is the sum of 2™ 2 terms, 
each term is the permutation and combination of |+), |— ) 
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and the number of |— ) in each term is even, we can also 
obtain 

1 n—l 

i«i> = ^=i^[(ni+>j®i->*. 

n— 3 

+ (IIl + )J® I -+)a„.ra n +"']- ( 35 ) 

i=2 

The right of the equation 123 is also the sum of 2™~ 2 
terms, each term is the permutation and combination of 
|+), |— ), but the number of | — ) in each term is odd. For 
example 

-L(|ooo) + |m>) = i(| + ++) + ! + —) 

+1 --+> + !-+-», (36) 

-^(|000)-|111)) BC = \(\ + +-) + ]+-+) 

+ !-++> + 1 ))-(37) 

Alice then measures the particle a, ai in the Z-basis 
and the receivers, n—l users measure the particle 
02, • • • , a„ in the X-basis, respectively. After doing these, 
Alice tells the users the order of checking sequence and 
randomly lets them announce firstly their results of mea- 
surements. Alice decides whether her random bit string 
can be recovered correctly by collaborating the n—l 
user's results. If the error rate is small, Alice can con- 
clude that there is no eavesdroppers in the line. She 
then announces the results of measurements of message 
encoding sequence. Thus the n—l users can collaborate 
to recover Alice's message. The security analysis of the 



multiparty QSS scheme is similar to that of the three- 
party case, as described in Sec lllll 



V. SUMMARY 

So far we have proposed an (n, n) threshold QSS 
scheme of secure direct communication. Alice encodes 
her secret message into a given state and sends it to the 
receivers directly using quantum channel. Without Al- 
ice's result of measurement, the receivers cannot have any 
information about Alice's secret message even if they col- 
laborate. Alice announces her result only if she is certain 
that there is no eavesdropping in the line and only in such 
a way can the receivers collaborate to recover Alice's se- 
cret message. By this token, the present scheme is similar 
to QSDC protocol, different from the QSS scheme whose 
task is essentially to allow a sender to establish a shared 
key with the receivers. In our scheme, the states that 
Alice prepared randomly are important that the eaves- 
dropping of the dishonest party or the eavesdropper, Eve 
can be detected easily. The present scheme is efficient in 
that all the GHZ states used in the scheme are used to 
generate shared secret messages except those chosen for 
checking eavesdropper, the classical messages exchanged 
between the communication parties only include the re- 
sults of the measurements, and the process of the scheme 
is also simple. 
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